Zennoxa Shield
Rules / C/C++
SHIELD-CPP-019

memcpy with unchecked length

highC/C++CWE-120CVSS 8.1

What it detects

memcpy or memmove with a variable length from input can overflow the destination buffer.

How to fix

Validate the length against the destination capacity before copying.

Vulnerable — Shield flags thispacket.c
#include <string.h>

void handle_packet(const unsigned char *payload, size_t len) {
    unsigned char frame[512];
    /* len is taken from the wire and never validated */
    memcpy(frame, payload, len);
}
Fixed — scans cleanpacket.c
#include <string.h>

int handle_packet(const unsigned char *payload, size_t len) {
    unsigned char frame[512];
    if (len > sizeof(frame))
        return -1;                  /* reject oversized input */
    memcpy(frame, payload, len < sizeof(frame) ? len : sizeof(frame));
    return 0;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-019, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CPP-019: memcpy with unchecked length — Zennoxa Shield